Critical Security: User sees *other* users chat bar
PostPosted: 15 Oct 2013, 08:24
Hi - I have a fairly serious issue here and would like some pointers. To be clear, I don't believe it is necessarily a arrowchat bug, but I'm getting mixed sessions.
Today a user of my forum (IPBoard) suddenly saw someone elses arrow chat bar...ie. The chat bar for a different user appeared on her screen. I saw this in the screenshot. And messages she sent in this chat session were indeed attributed to this other user.
Upon investigation, I see that both users had the same IP address! And somehow, this seemed to confuse Arrowchat so that one user was working with another users chat.
This is obviously a critical security hole, but I don't know what the issue may be me. It must clearly be related to the fact that two users had the same IP address (although one was in Wales and one in the US). And while this should not happen, it looks like the chat session has no unique session key? Is there something I can do that would prevent this?
Thanks for any insight
Chris
Today a user of my forum (IPBoard) suddenly saw someone elses arrow chat bar...ie. The chat bar for a different user appeared on her screen. I saw this in the screenshot. And messages she sent in this chat session were indeed attributed to this other user.
Upon investigation, I see that both users had the same IP address! And somehow, this seemed to confuse Arrowchat so that one user was working with another users chat.
This is obviously a critical security hole, but I don't know what the issue may be me. It must clearly be related to the fact that two users had the same IP address (although one was in Wales and one in the US). And while this should not happen, it looks like the chat session has no unique session key? Is there something I can do that would prevent this?
Thanks for any insight
Chris